Back to Browse
Environment variables (
Gateway headers (
Free
Server data from the Official MCP Registry
MCP server for ScalePad — Core, Lifecycle Manager, ControlMap, Backup Radar, and Quoter.
About
MCP server for ScalePad — Core, Lifecycle Manager, ControlMap, Backup Radar, and Quoter.
Security Report
10.0
Low Risk10.0Low RiskValid MCP server (3 strong, 2 medium validity signals). 1 known CVE in dependencies Imported from the Official MCP Registry. Trust signals: 3 highly-trusted packages.
4 files analyzed · 1 issue found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
What You'll Need
Set these up before or after installing:
ScalePad platform API key (generated in the ScalePad app by an Administrator)Required
Environment variable: SCALEPAD_API_KEY
Data-residency region for ControlMap/Backup Radar: 'us' (default), 'eu', 'ca', or 'au'
Environment variable: SCALEPAD_REGION
Optional Quoter OAuth Client ID — only for the standalone api.quoter.com path
Environment variable: QUOTER_CLIENT_ID
Optional Quoter OAuth Client Secret, paired with QUOTER_CLIENT_IDRequired
Environment variable: QUOTER_CLIENT_SECRET
Transport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.
Environment variable: MCP_TRANSPORT
Credential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.
Environment variable: AUTH_MODE
Log verbosity: debug, info, warn, error
Environment variable: LOG_LEVEL
Documentation
View on GitHubFrom the project's GitHub README.
scalepad-mcp
MCP server for the ScalePad platform — Core, Lifecycle Manager, ControlMap, Backup Radar, and Quoter — built natively on the MCP SDK v2 (2026-07-28 spec) with dual-era serving: the same endpoint answers both legacy 2025-era initialize-handshake clients and modern envelope clients.
Architecture
Flat tool surface: every tool is exposed upfront in tools/list for universal client compatibility. Navigation tools are discovery aids, not gates.
| Tool | Purpose |
|---|---|
scalepad_navigate | Describe a product domain's tools (core, lifecycle-manager, controlmap, backup-radar, quoter) — a help/discovery aid, not a prerequisite |
scalepad_status | Show credential status and available domains |
Product domains
| Domain | Tool prefix | Coverage |
|---|---|---|
core | scalepad_core_ | Unified platform data (read-only, US-only): clients, contacts, members, sites, opportunities, hardware/SaaS assets, product catalog, service contracts, tickets, integrations |
lifecycle-manager | scalepad_lm_ | Engagement/roadmap workflows: initiatives, goals, meetings, action items, assessments, deliverables, budgets, contracts, workspace |
controlmap | scalepad_cm_ | Compliance per client: risks, controls, evidence, policies, frameworks, assessments, action items (regions: us, eu, ca, au) |
backup-radar | scalepad_br_ | Read-only backup health and backup device inventory (regions: us, eu) |
quoter | scalepad_quoter_ | Quotes, catalog, contacts, suppliers, and standalone-OAuth helpers (defaults to the ScalePad-hosted Quoter API) |
All tools are callable at any time; scalepad_navigate simply summarizes a domain's tools.
Credentials
One ScalePad API key (generated in the ScalePad app by an Administrator) covers every product; endpoints for products without an active subscription return 402.
Environment variables (AUTH_MODE=env, default for stdio/local)
| Variable | Required | Notes |
|---|---|---|
SCALEPAD_API_KEY | yes | Forwarded to api.scalepad.com as x-api-key |
SCALEPAD_REGION | no | us (default), eu, ca, or au — selects the regional base URL for ControlMap (us/eu/ca/au) and Backup Radar (us/eu); Core and Lifecycle Manager are US-only |
QUOTER_CLIENT_ID | no | Only for the standalone api.quoter.com OAuth path (Quoter Account > API Keys, Account Owner only) |
QUOTER_CLIENT_SECRET | no | Paired with QUOTER_CLIENT_ID |
Gateway headers (AUTH_MODE=gateway, hosted deployment)
| Header | Required |
|---|---|
X-ScalePad-Api-Key | yes |
X-ScalePad-Region | no |
X-Quoter-Client-Id | no |
X-Quoter-Client-Secret | no |
In gateway mode credentials are bound per request from these headers; requests to /mcp without X-ScalePad-Api-Key are rejected with a 401 JSON-RPC error before any MCP handling (they never fall through to env credentials). /health stays unauthenticated.
Transports
- stdio (default):
node dist/index.js— for Claude Desktop / CLI. - HTTP:
MCP_TRANSPORT=http node dist/index.js— serves/mcp(dual-era,legacy: 'stateless') plus/health. Configure withMCP_HTTP_PORT(default8080) andMCP_HTTP_HOST(default0.0.0.0).
Development
export NODE_AUTH_TOKEN=$(gh auth token) # GitHub Packages read access
npm ci
npm run build # tsup (transpile-only; domains stay lazily importable)
npm test # vitest (HTTP layer: health, 401 gate, dual-era tools/list)
npm run smoke # dual-era smoke against dist/index.js
npm run typecheck
Domain handlers live in src/domains/<slug>.ts, each exporting export const handler: DomainHandler (see src/utils/types.ts), and are lazily loaded via src/domains/index.ts.
Docker
docker build --build-arg NODE_AUTH_TOKEN=$(gh auth token) -t scalepad-mcp .
docker run -p 8080:8080 -e AUTH_MODE=env -e SCALEPAD_API_KEY=... scalepad-mcp
The image defaults to AUTH_MODE=gateway for hosted deployment behind the WYRE MCP gateway.
License
Apache-2.0 — see LICENSE.
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
80.0K
Stars
9
Installs
6.5
Security
No ratings yet
Local
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
80.0K
Stars
9
Installs
5.3
Security
No ratings yet
Local
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
137
Stars
559
Installs
8.0
Security
4.8
Local